A monthly roundup of breaches and enforcement that matter to banks, payments and regulated firms, with the lessons I would take into an audit or incident response plan. Items marked as claims have not been confirmed by the organisation named.
UAE, Gulf and India
- UAE private-sector ransom (disclosed 15 September). Dr Mohamed Al Kuwaiti, head of cyber security for the UAE Government, said a hacker phoned him demanding more than $5 million after breaching an unnamed private company, destroying infrastructure data and later circulating stolen data on Telegram and the dark web.
- UAE Cyber Security Council (16 September). Dr Al Kuwaiti told CNN that Iran's Islamic Revolutionary Guard Corps is behind many attacks on the UAE, citing forensic evidence, and that the country faced 640,000 attacks on 15 September alone.
- Gulf threat data (18 September). Positive Technologies research reported by Khaleej Times found the UAE (35%) and Saudi Arabia (15%) accounted for half of recorded Gulf attacks in the first half of 2026, with vulnerability exploitation (38%) the leading method.
- India (10 September). LiveLaw reported that the Data Protection Board still had no chairperson or members, so CERT-In's six-hour reporting and 180-day log retention directions, alongside RBI and SEBI rules, remain the main breach obligations. I found no confirmed breach at an Indian or GCC bank or payments firm disclosed in September.
Major global incidents
- Revolut (disclosed 12 September). Revolut confirmed a "sophisticated external impersonation scam": fraudulent information requests from a legitimate government agency email domain led it to release data on a limited number of customers, reportedly including identity documents. Revolut said its systems and customer funds were unaffected.
- DriveWealth (access 4 to 5 September). The US brokerage infrastructure provider said "certain personal information was exfiltrated from our network" after what it described as a social-engineering campaign, affecting customers of Revolut, Stake and Hatch. It reported no unauthorised trades, transfers or withdrawals.
- Bitget (disclosed 25 September). The crypto exchange confirmed wallet thefts later revised to about $388 million. Bitget said attackers exploited a flaw in a third-party security product to obtain privileged credentials and send fraudulent withdrawal commands, and that its User Protection Fund would cover losses.
- BigCommerce (confirmed 17 September). API keys for the third-party Ribon apps were compromised and used to inject malicious scripts into a small number of merchant storefronts, with shopper contact and shipping details accessed. BigCommerce said its platform was not breached.
- Japan Digital Agency (disclosed 11 September). A VPN device vulnerability gave an attacker access to the Government Solution Service, potentially exposing about 246,000 records. Security Affairs reports a patch was already available.
- Bimbo Bakeries USA (notice filed 4 September). The company confirmed attackers exploited an Oracle E-Business Suite zero-day to take files including Social Security numbers, a theft first identified in December 2025.
Payment cards: I found no confirmed card-data breach this period; BigCommerce, Revolut and DriveWealth each said card or payment details were not exposed.
Regulatory enforcement
- France (3 September): the CNIL fined Hôpital Privé de la Loire €500,000 after an attacker used one account to reach data on 524,867 patients, citing remote access without MFA, excessive access rights and no real-time detection.
- Sweden (22 September): IMY fined software provider Miljödata SEK 1.8 million (about €160,000) under Article 32 GDPR after a cyberattack affecting about 2.2 million people, citing poor software vetting and no automated intrusion monitoring.
- Ireland and UK: the Data Protection Commission fined Google €403 million over location data on 21 September. On 24 September TikTok withdrew its appeals, making the ICO's £12.7 million children's data penalty final; the ICO became the Information Commission on 30 September.
- India DPDP Act: no penalties are possible yet. The Board is not constituted, and the penalty schedule does not engage until around 13 May 2027.
- UAE PDPL: executive regulations had still not been issued, according to Meydan Free Zone guidance updated on 18 September, so notification timelines and penalty amounts remain undefined.
- Bank regulators: I found no cyber-related penalty published by the RBI, CBUAE or SAMA in September.
Lessons for audit and incident response
- Verify the requester, not the domain. A genuine government email domain is not proof of authority. Verify law-enforcement and regulator data requests through an independently sourced contact, with a second approval before KYC files leave.
- Assess vendors' help desks, not just their certificates. DriveWealth's incident reached three platforms' customers. Ask critical providers how they verify callers and staff, and test data retention in third-party reviews.
- Treat payment page scripts as live controls. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 require an authorised inventory of payment page scripts and tamper detection. After BigCommerce, sample them during assessments rather than accepting a policy.
- Measure patch latency on edge devices. The Japanese and CNIL cases both turn on weak remote access. Track VPN patch times as a key risk indicator and confirm MFA on remote access under PCI DSS requirement 8.4.3.
- Assume privileged credentials will be abused. Bitget's losses came from stolen privileged credentials. Swift users should test that a compromised operator cannot bypass CSCF controls 2.9 (transaction business controls) and 5.1 (logical access control), and that 6.4 logging would alert.
Sources
- UAE cyber security chief reveals hacker demanded more than $5m in attack on private company (The National)
- Iran's IRGC behind many cyber attacks on UAE, says security chief (The National)
- 50% of cyberattacks in Gulf targeted UAE, Saudi Arabia in first half of 2026: Report (Khaleej Times)
- Compliance Without Court: What DPDPA Board's Vacancy Means For May 2027 (LiveLaw)
- New regulations give Indian orgs 6 hours to report cyber incidents (Dark Reading)
- Revolut confirms customer data breach through fake government requests (TechCrunch)
- Revolut customers in Ireland affected by third-party data breach (The Irish Times)
- DriveWealth security incident exposes Revolut, Stake and Hatch customer data (Finance Magnates)
- Hackers steal $351.6 million in Bitget crypto exchange hack (BleepingComputer)
- Bitget reveals hack cause and resumes bitcoin withdrawals (ForkLog)
- BigCommerce alerts merchants of data breach linked to Ribon apps (BleepingComputer)
- Unauthorised access to the Government Solution Service (Digital Agency, Japan)
- Non-zero-day VPN flaw left Japan's government shared network platform exposed (Security Affairs)
- Bimbo Bakeries confirms data stolen in Oracle EBS zero-day attack (CyberInsider)
- Sanction: fine against Hôpital Privé de la Loire (CNIL)
- Swedish DPA fines Miljödata i Karlskrona approximately EUR 160,000 (EDPB)
- Miljödata fined SEK 1.8 million after major data breach (Sweden Herald)
- Google hit with €403 million GDPR fine over location tracking (Help Net Security)
- TikTok withdrew appeal against ICO fine, rendering £12.7 million penalty notice final (Digital Policy Alert)
- ICO welcomes transition to new Information Commission (ICO)
- Data, privacy and cyber in August and September 2026 (DAC Beachcroft)
- UAE PDPL vs GDPR (Meydan Free Zone)